Overview
Probably the most convoluted IT practices of all, the Identity Management and Governance is always vulnerable to a security gap. After all, controlling a vast expanse that extends beyond the traditional realm of a datacenter demands careful planning.
While spiraling cost issues and inadequate resources often undermine the identity governance approach, the inherent shortcomings are too many. And how to overcome those shortcomings invariably will depend on whether an organization clings to the basic principles.
Broadly, the identity governance practice can be split up in three stages.
If we move down in descending order, then the stage one is where identity lifecycle management is at the core. Automation and risk-based scores for identities among many other tools enable to on-board, discover, including grant/revoke access rights to identities. The whole idea here is to uncover the security blind spots through automation.
The second stage is where the manual IT rules and processes complement the automation. Here the Information Security professionals will lay down an unambiguous set of rules as to password policy, authorization among other controls. The objective here is to avoid those mistakes that can prove costly due to the lack of policies and processes.
The stage three requires doing the basics right. It forms the foundation for robust identity management and governance practice. Here the IT security staff will use the data to the fullest to understand the patterns behind it. Based on the data, an organization can enhance the security by employing the basic tenants in Information Security, especially the identity management and governance.
